[dependabot]

Bumps body-parser from 1.20.8 to 2.4.0.

Release notes

Sourced from body-parser's releases.

v2.4.0

Important: Security

• Security fix for CVE-2026-111181 (GHSA-27r3-jxmh-p828)

What's Changed

• build(deps): bump actions/checkout from 6.0.3 to 7.0.0 by @​dependabot[bot] in expressjs/body-parser#737
• chore: group github actions updates by @​Phillip9587 in expressjs/body-parser#743
• build(deps): bump the github-actions group with 3 updates by @​dependabot[bot] in expressjs/body-parser#745
• test: fix 'presist' typo in test descriptions by @​maxtaran2010 in expressjs/body-parser#749
• docs: include security fix in 2.3.0 changes by @​UlisesGascon in expressjs/body-parser#748
• fix: avoid mutating read options when reading body by @​Phillip9587 in expressjs/body-parser#742
• refactor: move getCharset helper to only usage by @​Phillip9587 in expressjs/body-parser#707
• build(deps): bump the github-actions group with 7 updates by @​dependabot[bot] in expressjs/body-parser#753
• refactor: switch to neostandard by @​Phillip9587 in expressjs/body-parser#751
• perf(json): avoid first-char regex for direct JSON bodies by @​Phillip9587 in expressjs/body-parser#744
• docs: fix entity verify error description by @​Rawal27 in expressjs/body-parser#755
• feat: zstandard support by @​Phillip9587 in expressjs/body-parser#586
• test: remove unused experimentalZstd option by @​Phillip9587 in expressjs/body-parser#757
• ci: run tests on windows and macos matrix by @​kilisamemarisaaa in expressjs/body-parser#759
• deps: qs@^6.16.0 by @​krzysdz in expressjs/body-parser#762
• build(deps): bump the github-actions group with 3 updates by @​dependabot[bot] in expressjs/body-parser#763
• ci: trigger npm publish on release published and set dist-tag by @​UlisesGascon in expressjs/body-parser#768
• build(deps): bump the github-actions group with 3 updates by @​dependabot[bot] in expressjs/body-parser#771
• fix(test): pin supertest to 7.3.0 to avoid 7.3.1 regression by @​saadkhantareen in expressjs/body-parser#773
• perf: inline content stream setup by @​Phillip9587 in expressjs/body-parser#750
• docs: note that req.body may be undefined in v2 by @​Hashim1999164 in expressjs/body-parser#752
• docs: fix strict option description by @​Rawal27 in expressjs/body-parser#756
• docs: fix depth error description by @​johnnyhuirilef in expressjs/body-parser#776
• chore: update dependencies by @​Phillip9587 in expressjs/body-parser#778
• Release: 2.4.0 by @​UlisesGascon in expressjs/body-parser#777

New Contributors

• @​maxtaran2010 made their first contribution in expressjs/body-parser#749
• @​Rawal27 made their first contribution in expressjs/body-parser#755
• @​kilisamemarisaaa made their first contribution in expressjs/body-parser#759
• @​saadkhantareen made their first contribution in expressjs/body-parser#773
• @​Hashim1999164 made their first contribution in expressjs/body-parser#752
• @​johnnyhuirilef made their first contribution in expressjs/body-parser#776

Full Changelog: expressjs/body-parser@v2.3.0...v2.4.0

v2.3.0

Important: Security

• Security fix for CVE-2026-12590 (GHSA-v422-hmwv-36x6)

What's Changed

• build(deps): bump actions/download-artifact from 6.0.0 to 7.0.0 by @​dependabot[bot] in expressjs/body-parser#681

... (truncated)

Changelog

Sourced from body-parser's changelog.

2.4.0

• Security fix for GHSA-27r3-jxmh-p828 (CVE-2026-111181)
• feat: add zstd content-encoding support (#586)
  • Requires Node.js ^22.15.0 or >=23.8.0; older versions keep returning 415 for zstd encoded bodies
• fix: avoid mutating the parser options and the request object while reading the body (#742, #750)
• perf(json): avoid first-char regex for direct JSON bodies (#744)
• deps:
  • content-type@^2.1.0
  • iconv-lite^0.7.3
  • qs@^6.16.1

2.3.0

• Security fix for GHSA-v422-hmwv-36x6
• fix: use static exports instead of lazy getters to improve ESM compatibility
• feat: add subpath exports for individual parsers
• fix: improve limit option validation (#698)
  • Invalid limit values (e.g. unparseable strings or NaN) now throw instead of being silently ignored, which previously disabled size limit enforcement
  • null and undefined fall back to the default 100kb limit
• deps:
  • content-type@^2.0.0
  • http-errors@^2.0.1
  • iconv-lite^0.7.2
  • qs@^6.15.2
  • raw-body@^3.0.2
  • type-is@^2.1.0

2.2.2

• deps: qs@^6.14.1
• refactor(json): simplify strict mode error string construction

2.2.1

• Security fix for GHSA-wqch-xfxh-vrr4
• deps:
  • type-is@^2.0.1
  • iconv-lite@^0.7.0
    • Handle split surrogate pairs when encoding UTF-8
    • Avoid false positives in encodingExists by using prototype-less objects
  • raw-body@^3.0.1
  • debug@^4.4.3

2.2.0

... (truncated)

Commits

• b4744d7 2.4.0 (#777)
• f7075ea fix: prevent process crash from trailing bytes after a compressed body
• 185ff1d chore: update dependencies (#778)
• 73713f7 docs: fix depth error description (#776)
• 2dcc826 docs: improve readability (#756)
• 402dbdc docs: note that req.body may be undefined in v2 (#752)
• 9883a1e perf: inline content stream setup (#750)
• 02101da fix(test): pin supertest to 7.3.0 to avoid 7.3.1 regression (#773)
• 822a0fd build(deps): bump the github-actions group with 3 updates (#771)
• aa9889b ci: trigger npm publish on release published and set dist-tag (#768)
• Additional commits viewable in compare view

[resure]

probably would hold until major:

bodyless requests change from {} to undefined: default-filled body schemas return 400 instead of 200; ordinary body access can return 500